Then you fall back to needing to send some kind of login token to the user when they forget how to log in to the HTTPS site. Onerous security policies can make

Then you fall back to needing to send some kind of login token to the user when they forget how to log in to the HTTPS site. Onerous security policies can make things worse as people work around them behind your back. You can require certificates but there's nothing you can do to make sure that people don't put their keys in their dropbox for "safety" because they don't want to get yelled at for losing their keys when a machine crashes. People shop for VPSs partially based on convenience of management. If you make your system secure but inconvenient, you can lose the people who would would most benefit from a "good enough to stop the automated SSH bot" policy.